# Kiro CLI: other local users could read agent transcripts

> Kiro CLI left its session transcripts and prompt history readable by every other user account on the same Linux or macOS machine.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** AWS
- **Disclosed:** 2026-11-10
- **CVE:** CVE-2026-124848
- **Affects:** Kiro CLI, Amazon Q Developer CLI
- **Research by:** AWS Security (Amazon Web Services)
- **Primary source:** https://aws.amazon.com/security/security-bulletins/2026-178-aws/
- **Page:** https://theinjection.dev/items/aws-kiro-cli-transcript-file-permissions/

Kiro CLI wrote session transcripts and prompt history with permissions that let any other local user on the same macOS or Linux host read them, including any credentials or source code a session touched.

## What happened

AWS published bulletin 2026-178 on November 10, 2026 for CVE-2026-124848 in Kiro CLI, its coding agent, formerly Amazon Q Developer CLI. AWS states that the files recording a session could be read by other local users on the same macOS or Linux host. The Kiro CLI 2.27.0 changelog, dated October 1, 2026, describes the change only as tightening access to local Kiro state, and names no CVE.

## How it works

Kiro CLI created its session transcript and prompt history files with permissions open to other accounts on the host, instead of restricting them to the owner. AWS says the contents can include prompts, model responses and tool output, so any credential or snippet of source that passed through a session sat in a world-readable file. Nothing had to be misconfigured for the files to be written that way.

## Who is affected

The affected Kiro CLI range on macOS and Linux is listed below, along with a separate older file left by Amazon Q Developer CLI. A host where the agent's user is the only account has no second local reader, so the practical exposure is shared build machines, jump hosts and multi-user developer servers.

## What to do

Upgrade to Kiro CLI 2.27.0 or later and launch it once, which AWS says restricts session files written earlier to their owner. Delete or owner-restrict the old Amazon Q history file, and rotate any credential that appeared in a session on a shared host. Without an upgrade, AWS suggests running chmod -R go-rwx on ~/.kiro and setting umask 077 before launch.

## Quick facts

- **Affected:** Kiro CLI 1.16.0 up to 2.27.0, macOS and Linux
- **Fixed in:** Kiro CLI 2.27.0
- **CVE:** CVE-2026-124848
- **Disclosed:** November 10, 2026
- **Status:** Fixed; one relaunch repairs existing session files
- **Attack type:** Incorrect default file permissions
- **Also check:** ~/.aws/amazonq/.cli_bash_history from Amazon Q Developer CLI 1.16.0 to 1.19.x

## Questions

### Is Kiro CLI patched against CVE-2026-124848?

Kiro CLI 2.27.0 fixes CVE-2026-124848, and AWS says launching the agent once after upgrading restricts session files written earlier to their owner. Versions from 1.16.0 up to 2.27.0 are affected on macOS and Linux. AWS adds that forked or derivative code has to be patched separately, so an internal build of the agent does not inherit the fix.

### What was readable in the Kiro CLI session files?

Session transcripts and prompt history were readable, which AWS says can hold prompts, model responses, tool output, and any credentials or source code that appeared in them. The exposure is local: another user account on the same macOS or Linux host could open the files. A machine with a single user account has no second local reader.

### How do I restrict Kiro CLI files without upgrading?

AWS gives two workarounds. Run chmod -R go-rwx on ~/.kiro to restrict the existing directory, and set umask 077 before launching Kiro CLI so new files are created owner-only. Anyone who used Amazon Q Developer CLI 1.16.0 through 1.19.x should also run chmod go-rwx on the old bash history file, or delete it.

## Sources

1. [AWS Bulletin 2026-178](https://aws.amazon.com/security/security-bulletins/2026-178-aws/)
2. [Kiro CLI 2.27 Changelog](https://kiro.dev/changelog/cli/2-27)